IETF Logo Mail Archive

Re: [websec] #53: Clarify status of pin validation when used with private trust anchors

Chris Palmer <palmer@google.com> Tue, 28 May 2013 22:33 UTC

Return-Path: <palmer@google.com>
X-Original-To: websec@ietfa.amsl.com
Delivered-To: websec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A004621F89FF for <websec@ietfa.amsl.com>; Tue, 28 May 2013 15:33:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.977
X-Spam-Level:
X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, NO_RELAYS=-0.001]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vJCFPmH0Vq1G for <websec@ietfa.amsl.com>; Tue, 28 May 2013 15:33:58 -0700 (PDT)
Received: from mail-vb0-x235.google.com (mail-vb0-x235.google.com [IPv6:2607:f8b0:400c:c02::235]) by ietfa.amsl.com (Postfix) with ESMTP id 78ECE21F8A6B for <websec@ietf.org>; Tue, 28 May 2013 15:33:57 -0700 (PDT)
Received: by mail-vb0-f53.google.com with SMTP id p13so4416390vbe.40 for <websec@ietf.org>; Tue, 28 May 2013 15:33:56 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=OnBp/lUo6voBKl1Fh7jBmFTQIm/xfw2cFgjxt8xpexU=; b=K8tZwt27zccuIvVo1uh0y2SVEqNB088zDBROQA6/FbLHF05iM1u6+v8sOI3yiKJKQx lnSd2pcjHZcnLqnqn/c2bDqaD4MJMnSpTVaahlyK+gBqtknsJzSWXHEALq4ajHg8Lgm+ mySXTPcHw+T/dQB7UB5mxYIkd102hoSO0XXADcdTYSDNt1rUzxUnglP4mY2gdCVh091K ftlxL5jIkw5h26FBGo+YbuuBvT48JNDX4Ame0B0qFquuYXJEKRusZTuEjfYy/6bwLVst SZ57cw33yDuGlAwKc/hSCAT/Jw8psmnqPslU9T4nesFnHozh744mnlK5oUd55bB+2iQU AjLw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:x-gm-message-state; bh=OnBp/lUo6voBKl1Fh7jBmFTQIm/xfw2cFgjxt8xpexU=; b=EGwm4JSAm0Z4Nw+UQUZfUeeyXr3NPYqpX5VntVOeU7XDkCHvTmu62PwkeAvqwZFhsI 0kEqWxDlRyAvO3dmhNtGIcotCwzOX3Ta3oJXGGsxS+aK46oopJmuZM4M70pbm4Ct+hB8 Jy28o8ZCSe/H4IAi8jn+10JBfiGgNO5KJezhOjNzL/wnf1cZKCyzSEi4CikfK3WciThG JYQ6ae+fVtaaTWXqrb8KPE02E+jeEZ4jVUvirNDVBvqJhs2HOHE9ikTQmMtytfuMYKvM Dww4PtJjs+c0u4sQARWhBHngcLhKEebodgL/T39PDYadwg8qHrptGS3xEmkVfF4EmKWK cCZg==
MIME-Version: 1.0
X-Received: by 10.58.173.36 with SMTP id bh4mr19439320vec.9.1369780436739; Tue, 28 May 2013 15:33:56 -0700 (PDT)
Received: by 10.220.75.138 with HTTP; Tue, 28 May 2013 15:33:56 -0700 (PDT)
In-Reply-To: <9E7A30FE-E598-4A73-96DA-CC865E4A8C8D@checkpoint.com>
References: <058.27d97f66ed18f6f7f41e08788db76253@trac.tools.ietf.org> <073.7596c49c42f63bc38fe20a2ed8c59450@trac.tools.ietf.org> <51A49695.9080200@gondrom.org> <9E7A30FE-E598-4A73-96DA-CC865E4A8C8D@checkpoint.com>
Date: Tue, 28 May 2013 15:33:56 -0700
Message-ID: <CAOuvq21uPQdUHEN3noEYKBr01HToTdOSBTTnmRirSuqrXhACMQ@mail.gmail.com>
From: Chris Palmer <palmer@google.com>
To: Yoav Nir <ynir@checkpoint.com>
Content-Type: multipart/alternative; boundary="047d7b5da8135a3c5104ddcedc20"
X-Gm-Message-State: ALoCoQlyOfMvoMOtKPppWCdD0NuyoX78qXeWEq0zEvjct+jisVaDDt1LYq80KZHACCFgWb1wrg3qqMjXxNO1dB9E4z2jNUF3JZikjQ2KfOn3ePVt4rdYn4BFUGg6ct6cYabzCyH3WjmlWF8fdgOd7/r1U3wsj3KgxwQrIRCrjt9MpWZOugnghRgVmbI/ETyK2QAavbkB6EKS
Cc: "<websec@ietf.org>" <websec@ietf.org>
Subject: Re: [websec] #53: Clarify status of pin validation when used with private trust anchors
X-BeenThere: websec@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <websec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/websec>, <mailto:websec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/websec>
List-Post: <mailto:websec@ietf.org>
List-Help: <mailto:websec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/websec>, <mailto:websec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 28 May 2013 22:33:58 -0000

Thanks everyone. Closing it out.


On Tue, May 28, 2013 at 5:11 AM, Yoav Nir <ynir@checkpoint.com> wrote:

> I agree. I think that this non-strict behavior is something that UAs will
> implement anyway, because otherwise the UA doesn't work in any place that
> has a "next generation firewall" (which is pretty much any firewall these
> days)
>
> And if they did stick to only strict behavior, pretty much none of the
> potential servers would use HPKP.
>
> I agree that this text represents a middle ground that allows both UAs and
> servers to deploy the protocol.
>
> so, +1.
>
> Yoav
> (with no hats, except maybe a next-generation firewall vendor hat)
>
> On May 28, 2013, at 2:35 PM, Tobias Gondrom <tobias.gondrom@gondrom.org>
> wrote:
>
> > Hi Chris,
> >
> > I think so. (but am not 100% sure.)
> > Any other comments on this issue before we close it?
> >
> > Thanks, Tobias
> >
> >
> > On 25/05/13 02:41, websec issue tracker wrote:
> >> #53: Clarify status of pin validation when used with private trust
> anchors
> >>
> >>
> >> Comment (by palmer@google.com)
> >>
> >> The current draft has this text:
> >>
> >>  578 <t>If the connection has no errors, then the UA will determine
> >> whether to
> >>  579 apply a new, additional correctness check: Pin Validation. A UA
> >> SHOULD
> >>  580 perform Pin Validation whenever connecting to a Known Pinned Host,
> >> but MAY
> >>  581 allow Pin Validation to be disabled for Hosts according to local
> >> policy. For
> >>  582 example, a UA may disable Pin Validation for Pinned Hosts whose
> >> validated
> >>  583 certificate chain terminates at a user-defined trust anchor, rather
> >> than a
> >>  584 trust anchor built-in to the UA. However, if the Pinned Host
> Metadata
> >>  585 indicates that the Pinned Host is operating in "strict mode" (see
> >>  586 <xref target="strict"/>), then the UA MUST perform Pin
> >> Validation.</t>
> >>
> >> I believe this is the result of previous consensus. Is that correct, and
> >> can I therefore close this issue?
> >>
> >
> > _______________________________________________
> > websec mailing list
> > websec@ietf.org
> > https://www.ietf.org/mailman/listinfo/websec
>
> _______________________________________________
> websec mailing list
> websec@ietf.org
> https://www.ietf.org/mailman/listinfo/websec
>

v2.29.0 | Report a Bug | By Email | System Status